Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
127 results · page 1 of 3
Jul 27, 2026vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template ruCVE-2026-61511 · Other software · vBulletin · reported by VulnCheckCritical 9.3
vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication.
- Product
- vBulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.vbulletin.comforum.vbulletin.com
May 24, 2026A vulnerability was found in vBulletin 6.x.CVE-2026-9357 · Other software · reported by VulDBLow 2
A vulnerability was found in vBulletin 6.x. This impacts an unknown function of the component Login. Performing a manipulation results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. VulDB is withholding an extended redistribution of exploit details to prevent simplified exploitation. The vendor was contacted early about this disclosure but did not respond in any way.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2025vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint.CVE-2025-46171 · Other software · Vbulletin · reported by MITREMedium 5.4
vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy list, processing the list can consume excessive memory, exhausting system resources and crashing the forum.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2025Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.CVE-2025-48828 · Other software · vBulletin · reported by MITRECritical 9
Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025.
- Product
- vBulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.comkevintel.com
May 27, 2025vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or laterCVE-2025-48827 · Other software · vBulletin · reported by MITRECritical 10
vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.
- Product
- vBulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmainsecurity.comkevintel.com
Sep 15, 2023A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML viaCVE-2023-39777 · Other software · Vbulletin · reported by MITREMedium 5.4
A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Feb 5, 2023A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical.CVE-2014-125086 · Other software · Gimmie Project · reported by VulDBMedium 5.5
A vulnerability has been found in Gimmie Plugin 1.2.2 on vBulletin and classified as critical. Affected by this vulnerability is an unknown functionality of the file trigger_login.php. The manipulation of the argument userid leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The patch is named fe851002d20a8d6196a5abb68bafec4102964d5b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220207.
- Product
- Gimmie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2023A vulnerability, which was classified as critical, was found in Gimmie Plugin 1.2.2 on vBulletin.CVE-2014-125085 · Other software · Gimmie Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, was found in Gimmie Plugin 1.2.2 on vBulletin. Affected is an unknown function of the file trigger_ratethread.php. The manipulation of the argument t/postusername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The patch is identified as f11a136e9cbd24997354965178728dc22a2aa2ed. It is recommended to upgrade the affected component. VDB-220206 is the identifier assigned to this vulnerability.
- Product
- Gimmie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2023A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin.CVE-2014-125084 · Other software · Gimmie Project · reported by VulDBMedium 5.5
A vulnerability, which was classified as critical, has been found in Gimmie Plugin 1.2.2 on vBulletin. This issue affects some unknown processing of the file trigger_referral.php. The manipulation of the argument referrername leads to sql injection. Upgrading to version 1.3.0 is able to address this issue. The identifier of the patch is 7194a09353dd24a274678383a4418f2fd3fce6f7. It is recommended to upgrade the affected component. The identifier VDB-220205 was assigned to this vulnerability.
- Product
- Gimmie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2023vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization.CVE-2023-25135 · Other software · Vbulletin · reported by MITRECritical 9.8
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verify_serialized checks that a value is serialized by calling unserialize and then checking for errors. The fixed versions are 5.6.7 PL1, 5.6.8 PL1, and 5.6.9 PL1.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.vbulletin.comambionics.io
Oct 30, 2020vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request.CVE-2020-7373 · Other software · Vbulletin · reported by cve@rapid7.comCritical 9.8
vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.exploitee.rsforum.vbulletin.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.CVE-2020-25124 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via an admincp/attachment.php&do=rebuild&type= URI.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.CVE-2020-25123 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.CVE-2020-25122 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.CVE-2020-25121 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.CVE-2020-25120 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.CVE-2020-25119 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.CVE-2020-25118 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.CVE-2020-25117 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.CVE-2020-25116 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Sep 3, 2020The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.CVE-2020-25115 · Other software · Vbulletin · reported by MITREMedium 4.8
The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpentest-vincent.blogspot.compentest-vincent.blogspot.com
Aug 12, 2020vBulletin PHP Module Remote Code Execution VulnerabilityCVE-2020-17496 · Other software · vBulletin · reported by MITREExploitedCritical 9.8
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This CVE ID resolves an incomplete patch for CVE-2019-16759.
- Product
- vBulletin
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install vBulletin’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogblog.exploitee.rscwe.mitre.org
May 7, 2020vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.CVE-2020-12720 · Other software · Vbulletin · reported by MITRECritical 9.8
vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Oct 8, 2019vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.CVE-2019-17271 · Other software · Vbulletin · reported by MITREMedium 4.9
vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comforum.vbulletin.com
Oct 4, 2019vBulletin through 5.5.4 mishandles custom avatars.CVE-2019-17132 · Other software · Vbulletin · reported by MITRECritical 9.8
vBulletin through 5.5.4 mishandles custom avatars.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 4, 2019vBulletin before 5.5.4 allows clickjacking.CVE-2019-17131 · Other software · Vbulletin · reported by MITREMedium 4.3
vBulletin before 5.5.4 allows clickjacking.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.vbulletin.comforum.vbulletin.com
Oct 4, 2019vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.CVE-2019-17130 · Other software · Vbulletin · reported by MITREMedium 6.5
vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.vbulletin.comforum.vbulletin.com
Sep 24, 2019vBulletin PHP Module Remote Code Execution VulnerabilityCVE-2019-16759 · Other software · vBulletin · reported by MITREExploitedCritical 9.8
The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
- Product
- vBulletin
- On CISA’s list since
- Nov 3, 2021 (federal fix deadline May 3, 2022)
- What to do
- Attackers are using this now. Install vBulletin’s update today. If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Oct 17, 2018vBulletin 5.4.3 has an Open Redirect.CVE-2018-15493 · Other software · Vbulletin · reported by MITREMedium 6.1
vBulletin 5.4.3 has an Open Redirect.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2018library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session['user_agent'CVE-2018-12580 · Other software · Dragonbyte-tech · reported by MITREMedium 6.1
library/DBTech/Security/Action/Sessions.php in DragonByte vBSecurity 3.x through 3.3.0 for vBulletin 3 and vBulletin 4 allows self-XSS via $session['user_agent'] in the "Login Sessions" feature.
- Product
- Vbsecurity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddragonbyte-tech.comdragonbyte-tech.com
Jan 24, 2018vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.CVE-2018-6200 · Other software · Vbulletin · reported by MITREMedium 6.1
vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comcxsecurity.com
Jan 11, 2018Cross-site scripting (XSS) vulnerability in downloads/actions/editdownload.php in the DragonByte Technologies vBDownloads module 1.3.2 and earlier for vBulletinCVE-2012-6682 · Other software · Dragonbyte-tech · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in downloads/actions/editdownload.php in the DragonByte Technologies vBDownloads module 1.3.2 and earlier for vBulletin allows remote attackers to inject arbitrary web script or HTML via the mirrors[] parameter.
- Product
- Vbdownloads Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comdragonbyte-tech.com
Jan 11, 2018Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for vBulletin when creatiCVE-2012-6671 · Other software · Dragonbyte-tech · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in actions/main.php in the DragonByte Technologies Forumon RPG module before 1.0.8 for vBulletin when creating a new monster, allow remote attackers to inject arbitrary web script or HTML via the (1) monster[title] or (2) monster[description] parameters.
- Product
- Forumon RPG Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Jan 11, 2018Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote attackers to injectCVE-2012-6670 · Other software · Dragonbyte-tech · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the DragonByte Technologies vbActivity module before 3.0.1 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the reason parameter in (1) actions/nominatemedal.php or (2) actions/requestmedal.php.
- Product
- Vbactivity Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comdragonbyte-tech.com
Jan 11, 2018Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBulletin allow remote aCVE-2012-6668 · Other software · Dragonbyte-tech · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in the Shout Reports in the DragonByte Technologies vBShout module before 6.0.6 for vBulletin allow remote attackers to inject arbitrary web script or HTML via the (1) reportreason parameter in actions/doreport.php or (2) modnotes parameter in actions/updatereport.php.
- Product
- Vbshout Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comdragonbyte-tech.com
Jan 11, 2018Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to inject arbitrary web CVE-2012-6667 · Other software · Dragonbyte-tech · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in vbshout.php in DragonByte Technologies vBShout module for vBulletin allows remote attackers to inject arbitrary web script or HTML via the shout parameter in a shout action.
- Product
- Vbshout
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comexploit-db.com
Dec 13, 2017In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, coCVE-2017-17672 · Other software · Vbulletin · reported by MITRECritical 9.8
In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.securiteam.comexploit-db.com
Dec 13, 2017vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include diCVE-2017-17671 · Other software · Vbulletin · reported by MITRECritical 9.8
vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblogs.securiteam.comblogs.securiteam.com
Oct 26, 2017Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary CVE-2014-2023 · Other software · Tapatalk · reported by MITRECritical 9.8
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to (1) unsubscribe_forum.php or (2) unsubscribe_topic.php in mobiquo/functions/.
- Product
- Tapatalk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 19, 2017vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related CVE-2015-3419 · Other software · Vbulletin · reported by MITREMedium 6.5
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comvbulletin.com
Sep 15, 2017functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormesCVE-2014-9463 · Other software · Vbseo · reported by MITREHigh 8.8
functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php.
- Product
- Vbseo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.sucuri.netexploit-db.com
Aug 28, 2017Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3.CVE-2014-9469 · Other software · Vbulletin · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Apr 6, 2017In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url functionCVE-2017-7569 · Other software · Vbulletin · reported by MITREHigh 8.6
In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordvbulletin.comvbulletin.com
Sep 1, 2016The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4CVE-2016-6483 · Other software · Vbulletin · reported by MITREHigh 8.6
The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote attackers to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlegalhackers.comsecurityfocus.com
Aug 30, 2016SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackerCVE-2016-6195 · Other software · Vbulletin · reported by MITRECritical 9.8
SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in July 2016.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comvbulletin.org
Nov 24, 2015The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute aCVE-2015-7808 · Other software · Vbulletin · reported by MITREHigh 7.5
The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.checkpoint.compacketstormsecurity.com
Jan 2, 2015Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of adminiCVE-2014-9438 · Other software · Vbulletin · reported by MITREMedium 6.8
Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that (1) ban a user via the username parameter in a dobanuser action to modcp/banning.php or (2) unban a user, (3) modify user profiles, edit a (4) post or (5) topic, or approve a (6) post or (7) topic via unspecified vectors.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexchange.xforce.ibmcloud.com
Nov 6, 2014Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URLCVE-2014-8670 · Other software · Vbulletin · reported by MITREMedium 5.8
Open redirect vulnerability in go.php in vBulletin 4.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Oct 24, 2014Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to injeCVE-2014-2021 · Other software · Vbulletin · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Oct 15, 2014SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execCVE-2014-2022 · Other software · Vbulletin · reported by MITREHigh 7.1
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.
- Product
- Vbulletin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.